You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Nebuler, Downloader And Onther Trojans

I've done just about everything with my system I can think of, but as soon as I get rid of a virus, another takes its place. Arrgghh! I even tried deleting internet explorer, yet all the pop-ups are still somehow originating from there. Also, after my computer's been on a while and I try to open a file folder, the desktop 'refreshes' but doesn't open the folder. please help me before I throw my computer on the freeway.

I want you to run vundofix again, but there will be extra instructions in my post.

It's better to print out the next instructions or save them in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.It is also important you don't miss a step and perform everything in the right order!!

You will receive a message saying vundofix will close and re-open in a minute or less. Click OK

When VundoFix re-opens,

Right click the list box (white box) in the main VundoFix window.

Select Add More Files? from the menu that comes up. This will open a new VundoFix window.

In the Window: copy and paste next in the first field: C:\WINDOWS\SYSTEM32\pmnonno.dll

Copy and paste next in the second field: C:\WINDOWS\SYSTEM32\winemx32.dll

Click the Add Files button.

Click the "Close Window" button.

Click the Remove Vundo button.

You will receive a prompt asking if you want to remove the files, click YES

Once you click yes, your desktop will go blank as it starts removing Vundo.

When completed, it will prompt that it will shutdown your computer, click OK.

Turn your computer back on.

* Download smitRem and save the file to your desktop.Doubleclick it and choose install. This will create a new folder on your desktop with the name smitrem.

* Reboot into Safe Mode`: ( without networking support !)°To get into the Windows XP Safe Mode, restart your computer and, just before Windows starts to load, tap the F8 key a few times. Choose Safe Mode from the menu that will appear and press Enter.

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.Wait for the tool to complete and disk cleanup to finish.

* Reboot back into Windows normal mode.

* Perform an onlinescan with panda: (please use this scanner instead of any other scanner!)Panda Online- Once you are on the Panda site click the Scan your PC button- A new window will open...click the Check Now button- Enter your Country- Enter your State/Province- Enter your e-mail address and click send- Select either Home User or Company- Click the big Scan Now button- If it wants to install an ActiveX component allow it- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)- When download is complete, click on Local Disks to start the scan- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.Post the contents of the Panda scan report together with a new hijackthislog, the contents of smitfiles.txt which is present on your Homedrive (C:\ in most cases) and the log from Vundofix in you next reply.

What do you mean with the Panda online scan? Try this scan instead (in IE)

Please perform this online scan: Kaspersky Webscan1. Read the Requirements and Privacy statement, then select "Accept"2. A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab3. Select "Install" to download the ActiveX controls that allows ActiveScan to run.4. If running MSAS beta you may receive an alert that an IE ActiveX program requires your approval. Click "Allow"5. When the download is complete it will say ready, click "Next"6. Select a target to scan: Click on "My Computer"7. When the scan is complete choose to save the results as "Save as Text"8. Post the Kaspersky scan results in your next reply.